CVE-2004-1384
phpGroupWare <= 0.9.16.003 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1384. PoCs published by GulfTech Security.
AI-analyzed exploit summary This is a vulnerability writeup describing SQL injection and XSS issues in PHPGroupWare 0.9.16.003. It includes a sample XSS payload but lacks executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum] parameters to index.php or (10) ticket_id to viewticket_details.php.
Exploits (2)
This is a vulnerability writeup describing SQL injection and XSS issues in PHPGroupWare 0.9.16.003. It includes a sample XSS payload but lacks executable exploit code.
The provided text describes multiple input validation vulnerabilities in PHPGroupWare, including SQL injection and cross-site scripting (XSS) issues. It includes example URLs demonstrating XSS payloads but does not contain executable exploit code.